2D-Doc: The Code on French Tax Notices Is Not a QR Code
The small square marked "2D-DOC" on a French tax notice or energy bill is not a QR code: it is an electronically signed Data Matrix code, built to a standard from the Agence nationale des titres sécurisés (ANTS), France's secure documents agency. It carries the document's key data and a signature. A suitable reader checks that the data has not changed since issue, which no ordinary QR code can do.
People often call it a "QR code" because it looks like one. The difference is not a matter of vocabulary: it explains why a phone camera is not enough to check a supporting document, and why nobody can make a convincing one with a generator.
What exactly is 2D-Doc?
2D-Doc is a visible electronic seal format published by the ANTS, which now presents itself as France Titres. It encodes part of a document's data, the issue date and the issuer's electronic signature of that data inside a Data Matrix symbol.
Version 3.3.1 of the 2D-Doc technical specification, dated 10 April 2024, defines every byte. The first version dates from February 2012. The content always follows the same order:
- A header starting with the letters "DC", followed by the standard's version, the certificate authority identifier, the identifier of the certificate used, the document's issue date, the signature date and the document type. Dates are encoded as the number of days since 1 January 2000.
- A message made of fields, each preceded by a two-character identifier: name, address, amount, depending on the document type.
- A signature computed over the header and message, using NIST P-256 or P-384 elliptic curves.
The graphic symbol is fixed: a square Data Matrix compliant with ISO/IEC 16022, error correction level ECC 200, with the readable label "2D-DOC" along one of its sides.
The need goes back a long way. The specification recalls that in 2008, nearly half of the identity fraud files handled by the French document fraud unit contained a fake energy or phone bill.
Which documents carry a 2D-Doc?
Mainly the supporting documents used for administrative procedures: income tax notices, bills used as proof of address, and a growing number of other private documents.
In an answer published in the Journal officiel on 30 January 2024, the Ministry of the Interior states in its reply to written question no. 9741 that 2D-Doc is built into tax notices and the new national identity card, and that it is open to private organisations for payslips and proof of address. It can hold the document type, the person's surname and first name, the address, the reference tax income for a tax notice, net pay for a payslip, and the issue date.
On the issuing side, the specification lists energy suppliers, phone operators and water utilities for bills, the DGFiP (the French tax administration) for tax notices, and banks for bank account details. On the receiving side: town halls, prefectures, social security bodies and banks.
An episode from 2026 shows the code can go missing for a while. At the end of July 2026, a user reported on the Services Publics+ platform that the 2D-Doc was absent from their 2026 tax notice downloaded online, which they needed for an identity card application. The DGFiP replied that the code should appear on online notices in early August 2026 after an update. A notice downloaded before then is worth downloading again.
How do you verify a 2D-Doc?
With a 2D-Doc reader, not a plain code scanner. The 2024 ministerial answer mentions a free smartphone app that checks authenticity with a trusted third party listed by the ANTS.
The specification describes the algorithm these readers follow, in seven steps that can be summarised as:
- Recognise the header and work out the document type and the list of expected fields.
- Validate the message structure against that definition.
- Compare the decoded data with the data printed in plain text on the document. This is the step that falls to you.
- Fetch the issuer's certificate using the header identifiers, by querying the trust list of authorised certificate authorities.
- Check that the certificate has not been revoked.
- Check that the signature date falls within the certificate's validity period.
- Verify the signature with the certificate's public key.
If everything passes, you know two things: the code's data was signed by a listed issuer, and it matches what is printed. You do not know that the person in front of you is the person named on the document.
Why is a phone camera not enough?
Because decoding is not verifying. Depending on the app, the camera will either ignore the Data Matrix or show a long string of characters starting with "DC". Either way, nothing checks the signature.
The readable part looks like upper-case text, because the standard uses C40 encoding, which is compact for capital letters and digits. The signature shows up as a meaningless run of characters. For it to prove anything, you need the issuer's certificate, which the code does not contain: the specification notes it would make the symbol far too large. Only a reader connected to the trust list goes and fetches it.
The differences between symbologies are covered in our comparison of QR, Data Matrix, PDF417 and Aztec. Data Matrix ECC 200 relies, like the QR code, on Reed-Solomon error correction, which we explain in our article on decoding.
Can you make a 2D-Doc yourself?
You can draw a Data Matrix containing the same text, but not a valid 2D-Doc. The signature requires a private key tied to a certificate issued by a certificate authority on the trust list, and a fake fails at step 7.
The specification even reserves identifiers for testing, such as "0000" certificates, and forbids their use in production. A QR code generator, ours included, therefore does not produce 2D-Docs and should not be presented as doing so.
The lesson holds for any business that wants its documents to be verifiable. A QR code pointing to a "verify this document" page on your website proves nothing to a recipient who cannot be sure the page is yours, and that is exactly the scenario fraudsters imitate, as our page on fake QR codes shows. If your invoices or certificates are used as supporting documents, the route is a listed 2D-Doc provider. A structured electronic invoice under France's 2026 reform is a different subject again, covered in our article on French e-invoicing.
What does the code prove, document by document?
A landlord, a letting agency or an HR department can use this table to see what verification establishes and what it leaves open.
| Document | What verification establishes | What it does not establish |
|---|---|---|
| Income tax notice | Name and reference tax income as issued by the DGFiP | That the person presenting it is the taxpayer |
| Energy or phone bill | Name and address on the issue date | That the person still lives at that address |
| Payslip (if the employer signs with 2D-Doc) | Net pay as issued by the signing issuer | That the employment contract is still running |
| Credit-card format national identity card | Identity data as recorded at issue | That the card has not since been reported lost or stolen |
How do you print a document without damaging the code?
Print at 100%, without "fit to page". The specification recommends a module of at least 0.4 mm when the printer is not known, and states that a format "02" code holding an invoice's mandatory fields then measures 19.2 mm a side, 20 mm with its margin.
Shrinking at print time pushes the modules below that threshold, and a damaged code no longer verifies, even when the document is genuine. Two other rules in the standard concern printing: a blank zone of at least one module around the code, which our article on the quiet zone explores, and a code placed on the same page as the data it repeats.
Frequently asked questions
Does a photocopy of a genuine document pass verification?
Yes, if the code stays readable, because verification is about the signed data, not the paper. That is why a valid 2D-Doc does not prove that the person presenting it is the holder.
Can a 2D-Doc stop being verifiable?
Yes. If the issuer's certificate is revoked, the specification states that verification is no longer possible, whatever the document's signature date.
Is the code on the new identity card a 2D-Doc?
According to the January 2024 ministerial answer, yes: 2D-Doc is built into the new credit-card format national identity card, alongside the card's other security features.